Analytics BIOC
Low
✕
SPNs cleared from a machine account
Service principal names were cleared from a machine account.
- Module:
- Identity Analytics
- Data source:
- Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
ATT&CK techniques: Account Manipulation (T1098) Valid Accounts (T1078)
Attacker's goals:
Elevate privileges from standard domain user to domain admin.
Investigative actions:
Follow actions performed by the user. Look for associated sAMAccountName rename events.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- SPNs cleared from a machine account for the first time Medium (parent: Low)